EXPLORE DETECTIONS
Device Code Sign-In
Detects authentication events using the device code flow as identified by Microsoft Defender for Identity, where a user enters a code on a separate device to complete sign‑in. While commonly used for legitimate scenarios, this method can be abused by attackers to perform phishing‑based authentication or bypass traditional sign‑in monitoring Detects authentication events using the device code flow as identified by Microsoft Defender for Identity, where a user enters a code on a separate device to complete sign‑in. While commonly used for legitimate scenarios, this method can be abused by attackers to perform phishing‑based authentication or bypass traditional sign‑in monitoring
Devices in RFM state
Devices in RFM state
Disable Strong Authentication (Microsoft Entra ID)
Detects when strong authentication methods (such as MFA) are disabled or weakened for a user account in Microsoft Entra ID. This action reduces account security and may indicate a legitimate administrative change or a potential attempt to bypass authentication controls and should be reviewed. Detects when strong authentication methods (such as MFA) are disabled or weakened for a user account in Microsoft Entra ID. This action reduces account security and may indicate a legitimate administrative change or a potential attempt to bypass authentication controls and should be reviewed.
Dll-Side Loading Detection Query
The query traces processes that write both DLL and EXE files to the same location while exhibiting masquerading behavior. Reference: [GitHub Aamir-Muhammad/CrowdStrike-Queries](https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/DLL-Side-Loading-Detection.md)
Dll-Side Loading Detection Query
The query traces processes that write both DLL and EXE files to the same location while exhibiting masquerading behavior. Reference: [GitHub Aamir-Muhammad/CrowdStrike-Queries](https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/DLL-Side-Loading-Detection.md)
DNS Resolutions from Browser Processes
This query correlates web browser process executions with their DNS queries to identify which domains were resolved by browser processes on specific endpoints
DNS Resolutions from Browser Processes
This query correlates web browser process executions with their DNS queries to identify which domains were resolved by browser processes on specific endpoints
DNS Staging Detection: ClickFix-Inspired nslookup Execution
Detects nslookup activity used for DNS-based staging, specifically targeting the pattern of querying external nameservers to retrieve and execute malicious payloads, as seen in recent ClickFix attacks. This hunt is highly valuable as it identifies a shift away from heavily-monitored tools like mshta and PowerShell toward abusing trusted network utilities to bypass standard firewalls and blend with legitimate DNS traffic. Targeting trusted binaries: Monitors nslookup.exe, which attackers now prefer because it is less likely to be blocked by security software than mshta or PowerShell. DNS Record Retrieval: Looks for nslookup commands that request TXT or ALL record types, which are commonly abused to stage content over DNS. Staging Pattern: Detects the use of findstr on the nslookup output, a known ClickFix-inspired technique to parse returned DNS content and prepare it for follow-on execution. Execution Chain: Monitors for nslookup output being piped through findstr and for /f and then into cmd, which is a strong indicator of DNS response data being transformed into executable input. Evasion Detection: DNS traffic is frequently allowed through corporate firewalls, making this a "lightweight staging channel" that effectively hides data exfiltration and payload delivery in plain sight. To test your query, run a command that matches the full pipeline pattern, for example: nslookup -q=txt google.com | findstr /i "Name" | for /f "tokens=*" %i in ('more') do cmd /c %i. Wait a few minutes for the telemetry to ingest, then run your search to confirm the activity appears in your results.
DNS Staging Detection: ClickFix-Inspired nslookup Execution
Detects nslookup activity used for DNS-based staging, specifically targeting the pattern of querying external nameservers to retrieve and execute malicious payloads, as seen in recent ClickFix attacks. This hunt is highly valuable as it identifies a shift away from heavily-monitored tools like mshta and PowerShell toward abusing trusted network utilities to bypass standard firewalls and blend with legitimate DNS traffic. Targeting trusted binaries: Monitors nslookup.exe, which attackers now prefer because it is less likely to be blocked by security software than mshta or PowerShell. External DNS Queries: Specifically looks for nslookup commands that provide a direct IP address for an external nameserver, bypassing the system's default, monitored DNS resolver. Staging Pattern: Detects the use of findstr on the nslookup output, a known ClickFix technique to parse the "Name:" field from a DNS response and treat it as a secondary command for execution. Execution Chain: Monitors for the piping of this output directly into execution engines like PowerShell or IEX. Evasion Detection: DNS traffic is frequently allowed through corporate firewalls, making this a "lightweight staging channel" that effectively hides data exfiltration and payload delivery in plain sight. To test your query, run nslookup -q=txt google.com 1.1.1.1 in a command prompt. This triggers your detection by requesting a TXT record while bypassing local DNS to use an external IP. Wait a few minutes for the telemetry to ingest, then run your search to confirm the activity appears in your results.
Domain Admin Enumeration
This query will detect Domain Admin Enumeration based on the Microsoft Defender for Identity Module This query will detect Domain Admin enumeration based on the Microsoft defender for Identity log sources.
Domain Controllers with high load
Domain controllers with either average CPU usage, average RAM usage that exceeds 80% or Available Disk space < 10GB. This indicates low capacity or unexpected excessive usage.
Domain Controllers with high load
Domain controllers with either average CPU usage, average RAM usage that exceeds 80% or Available Disk space < 10GB. This indicates low capacity or unexpected excessive usage.
EDRCHOKER - QoS Policy Abuse Targeting EDR/AV Processes
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names. Reference: https://github.com/Aamir-Muhammad/CrowdStrike-Queries/blob/main/Hunting-Queries/edrchoker---qos-policy-abuse-targeting-edrav-processes.cql
Encoded PowerShell Command Execution
This query identifies PowerShell and pwsh executions that pass a Base64-encoded command via -EncodedCommand (or any of its accepted prefixes such as -e, -ec, -enc), decodes the payload inline and enriches the result with the executing user. Encoded commands are a common obfuscation technique used by malware loaders, offensive frameworks and living-off-the-land attacks. This query uses CrowdStrike Query Language (CQL) to detect and decode encoded PowerShell commands: 1. **Event Filtering**: `#event_simpleName=ProcessRollup2 ImageFileName=/\\(powershell|pwsh)\.exe$/i` - Searches ProcessRollup2 events for Windows PowerShell (`powershell.exe`) and PowerShell 7 (`pwsh.exe`), case-insensitive 2. **Caret Normalisation**: `replace("\\^", with="", field=CommandLine, as=cmd)` - Removes `cmd.exe` caret escapes (e.g. `-e^n^c`) into a working copy `cmd`, so obfuscated parameter names are matched without listing every caret position in the regex. The original `CommandLine` is kept untouched for the output. 3. **Parameter Matching**: `cmd=/\s[-\/]e(c|nc?[a-z]*)?\s+(?<b64>[A-Za-z0-9+\/=]{16,})/i` - PowerShell accepts any unambiguous prefix of `-EncodedCommand`. The pattern matches `-e`, `-ec`, `-enc`, `-encoded`, `-encodedcommand` and the `/` parameter prefix, while excluding `-ex`/`-ep` (ExecutionPolicy) - Captures the following Base64 argument into the field `b64` 4. **Payload Decoding**: `decoded := base64Decode(b64, charset="UTF-16LE")` - PowerShell encodes commands as UTF-16LE. Decoding inline saves the round trip to an external tool during triage 5. **User Context**: `join({#event_simpleName=UserIdentity}, field=[aid, AuthenticationId], include=[UserName], mode=left)` - Enriches results with the executing user. The key is `[aid, AuthenticationId]` because logon IDs are only unique per host. `mode=left` keeps hits even when no matching UserIdentity event exists in the search window 6. **Output**: `table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine, decoded])` - Displays the parent process, the original command line and the decoded payload for analysis
Enriched Process Tree Association Events
The query filters for AssociateTreeIdWithRoot events, joins them with detection-pattern metadata from a CSV file, and outputs key fields like timestamp, host, pattern details and severity for analysis. In short, it enriches process-tree association events with contextual detection information. ## [AssociateTreeIdWithRoot](https://docs.crowdstrike.com/r/associatetreeidwithroot) This event is generated when there is a detection in the sensor. This event has a data field called PatternId that contains a pattern ID. Pattern IDs correspond to a detection. Reference[GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/AssociateTreeIdWithRoot%20to%20Pattern%20Details.md)
Enriched Process Tree Association Events
The query filters for AssociateTreeIdWithRoot events, joins them with detection-pattern metadata from a CSV file, and outputs key fields like timestamp, host, pattern details and severity for analysis. In short, it enriches process-tree association events with contextual detection information. ## [AssociateTreeIdWithRoot](https://docs.crowdstrike.com/r/associatetreeidwithroot) This event is generated when there is a detection in the sensor. This event has a data field called PatternId that contains a pattern ID. Pattern IDs correspond to a detection. Reference[GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/AssociateTreeIdWithRoot%20to%20Pattern%20Details.md)
Enumerate Windows Driver Loads
The query combines DriverLoad and Event_ModuleSummaryInfoEvent data to associate loaded driver hashes with their certificate details, simplifying file paths and aggregating filenames, subjects, and issuers for analysis of driver authenticity. Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Windows%20Driver%20Loads.md)
Enumerate Windows Driver Loads
The query combines DriverLoad and Event_ModuleSummaryInfoEvent data to associate loaded driver hashes with their certificate details, simplifying file paths and aggregating filenames, subjects, and issuers for analysis of driver authenticity. Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate%20Windows%20Driver%20Loads.md)
Evaluate Operating System Prevalence
This query counts how many Windows endpoints are running each OS version (like Windows 10, Windows 11, etc.) in your CrowdStrike environment. It groups endpoints by their current OS product name and returns the count for each version.
Evaluate Operating System Prevalence
This query counts how many Windows endpoints are running each OS version (like Windows 10, Windows 11, etc.) in your CrowdStrike environment. It groups endpoints by their current OS product name and returns the count for each version.
Exploitable Critical Vulnerabilities
Shows Critical CVEs that are considered exploitable (based on ExploitStatusEnum > 30). Results are aggregated by CVE and exploitability state, including the number of affected hosts.
Exploitable Critical Vulnerabilities
Shows Critical CVEs that are considered exploitable (based on ExploitStatusEnum > 30). Results are aggregated by CVE and exploitability state, including the number of affected hosts.